#831 auth: SAML 2.0 support for osctrl-api + React SPA Pull request opened by alvarofraguas Summary • Adds SAML 2.0 authentication to

osctrl-api

via a new

pkg/auth/saml/

provider implementing the same

auth.Provider

interface as OIDC • New endpoints:

GET /auth/saml/login

,

POST /auth/saml/acs

(Assertion Consumer Service),

GET /auth/saml/metadata

(SP metadata) • JIT user provisioning on first SAML login (creates user with

auth_source: saml

) • SPA login page shows SAML SSO button when SAML is configured (alongside OIDC if both are enabled) • Per-session

auth_source

stamp ensures logout routes to the correct IdP • SP signs every AuthnRequest (

AuthnRequestsSigned=true

) • InResponseTo correlation enforced (closes XML Signature Wrapping vector S7) • HTTPS-ready state cookie with

SameSite=None; Secure

for cross-origin SAML POST binding • Replay cache prevents assertion reuse Depends on • #830 (OIDC support — establishes the auth flow patterns this PR follows) Test plan • SAML login against Keycloak IdP — full flow including ACS, JIT provisioning, logout • SAML login against Auth0 IdP — attribute name differences handled • 41/41 SAML pentest checks pass (XSW, unsigned assertions, replay, audience confusion, clock-skew, recipient mismatch, InResponseTo, alg-downgrade, XXE, RelayState injection, encrypted assertions) • OIDC login still works when both SAML and OIDC are configured •

go test ./...

passes • Frontend builds clean jmpsec/osctrl